Layer 2 and layer 3 (for example, VLANs, IP addressing, gateways, routing, switching)

What is the fundamental difference between Layer 2 and Layer 3 in the OSI model, and how does it relate to networking in AWS?

The fundamental difference lies in the functions they provide. Layer 2, the Data Link Layer, is responsible for communication between adjacent network nodes within the same network segment, often using MAC addresses; it primarily handles switching, VLANs and the physical addressing. Layer 3, the Network Layer, facilitates data transmission between different network segments and performs logical addressing, routing, and path determination, often utilizing IP addresses. In AWS, Elastic Network Interfaces (ENIs) operate at Layer 2, while routing tables and Internet Gateways work at Layer 3 to facilitate inter-connectivity and external access.

How do VLANs work and what issue do they solve in a network infrastructure?

VLANs, or Virtual Local Area Networks, work by logically segmenting a physical network into multiple broadcast domains, which helps reduce broadcast traffic, improve security by isolating sensitive data and enhance network management. In a cloud environment like AWS, VLANs aren’t directly managed by users but AWS uses a similar concept of logically isolated sections of the AWS cloud known as VPCs (Virtual Private Clouds) to provide network segmentation.

How does IP addressing function within a VPC, and what is the role of CIDR?

Inside a VPC, IP addressing functions to assign private IP addresses for internal communication within the AWS infrastructure. CIDR, or Classless Inter-Domain Routing, defines the IP address range and size of the VPC; it enables the use of subnet masks to designate the network boundary uniquely for each VPC and its associated subnets. CIDR thereby enables efficient allocation of IP addresses and defines network and host portions of addresses.

Can you explain the difference between static and dynamic routing, and how does AWS support both routing types?

Static routing involves fixed paths defined manually by network administrators, while dynamic routing uses protocols to automatically adjust paths between networks based on current conditions. AWS supports static routing with manually modified route tables. For dynamic routing, AWS offers BGP (Border Gateway Protocol) via AWS Direct Connect or dynamic VPN connections, where routes are automatically updated in response to changes in the network topology.

What is a routing table, and how does it function within an AWS VPC?

A routing table contains a set of rules, known as routes, that determine where network traffic is directed based on the destination IP address. Within an AWS VPC, routing tables are associated with each VPC subnet to control the flow of traffic between subnets, the internet, or other AWS services. The VPC routing tables allow for specifying which subnets are publicly accessible versus which are private.

How do subnetting and IP addressing work together in network design?

Subnetting divides a larger network into smaller, more manageable segments. By associating a smaller IP address range (or subnet) with each divided network segment, subnetting enables more efficient use of IP addresses and can enhance network security and performance. In a network design, this allows for logical separation of network resources and more fine-grained control over network traffic.

Can you describe what a network gateway is, and mention the types of gateways used in AWS?

A network gateway is a networking device that connects two different networks and allows traffic to be routed between them. In AWS, the commonly used types include Internet Gateways, which allow communication between instances in a VPC and the internet; NAT Gateways, which enable instances in a private subnet to connect to the internet or other AWS services without allowing inbound traffic; and Virtual Private Gateways, which connect the VPC to an on-premises network via VPN.

Please explain the concept of an IP address and the main differences between IPv4 and IPv

An IP address is a unique identifier assigned to each device on a network, functioning to enable the device to communicate with others on the network. IPv4 addresses are 32-bit numbers often expressed as four decimal digits separated by periods, while IPv6 addresses are 128-bit numbers written as eight groups of four hexadecimal digits separated by colons. IPv6 provides a much larger address space than IPv4, which is crucial due to the exhaustion of IPv4 addresses.

What is the purpose of a switch in a network, and how is it relevant in the AWS context?

A switch operates at Layer 2 to connect devices within the same network segment. It uses MAC addresses to forward data frames to the correct device. While AWS customers don’t manage physical switches, the concept is relevant in the virtual networking environment, as AWS’s virtualized infrastructure performs switching functions internally to manage traffic between instances and different services.

What are the considerations for choosing between a hardware VPN and AWS Direct Connect for connecting an on-premises network to AWS?

When choosing between hardware VPN and AWS Direct Connect, considerations include the required bandwidth, latency sensitive applications, reliability, and cost. A hardware VPN over the public internet is typically more cost-effective and easier to set up for smaller data requirements, while AWS Direct Connect provides a dedicated private connection for higher throughput and a more consistent network experience.

Describe how route propagation works in AWS in conjunction with Virtual Private Gateways (VGWs).

In AWS, route propagation allows for automatic propagation of routes from a Virtual Private Gateway (VGW) to a VPC’s routing tables. When enabled on a route table, any routes learned by the VGW (typically via BGP from a Direct Connect or VPN connection) are automatically added to the VPC routing table, simplifying route management and ensuring that the VPC has the necessary routes to communicate with on-premises networks.

What is the main role of a Border Gateway Protocol (BGP) in AWS, especially when dealing with AWS Direct Connect and VPN connections?

The main role of BGP in AWS, in the context of AWS Direct Connect and VPN connections, is to manage the exchange of routing information between the AWS environment and an on-premises network. This dynamic routing protocol allows AWS and the customer’s network to communicate about the best paths for traffic, ensuring route optimization and facilitating automatic failover in the case of a network failure or change in path availability.